29 lines
1 KiB
Rust
29 lines
1 KiB
Rust
|
//! Source credential registry and grant-bound secret resolution.
|
||
|
|
//!
|
||
|
|
//! Durable metadata and authorization state live in PostgreSQL. Secret material
|
||
|
|
//! is stored in Vault KV v2 behind server-allocated paths and immutable versions.
|
||
|
|
//! Submission pins the current authorized version into an execution grant; the
|
||
|
|
//! trusted resolver accepts only an ActiveCredentialGrant capability formed
|
||
|
|
//! after durable grant activity is verified.
|
||
|
|
|
||
|
|
mod authz;
|
||
|
|
mod error;
|
||
|
|
mod ids;
|
||
|
|
mod migrate;
|
||
|
|
mod registry;
|
||
|
|
mod resolve;
|
||
|
|
mod types;
|
||
|
|
mod vault;
|
||
|
|
|
||
|
|
pub use authz::{CredentialCaller, may_manage, require_manage};
|
||
|
|
pub use error::CredentialError;
|
||
|
|
pub use migrate::{migrate, migrator};
|
||
|
|
pub use registry::CredentialRegistry;
|
||
|
|
pub use resolve::GrantBoundResolver;
|
||
|
|
pub use types::{
|
||
|
|
CreateCredential, CredentialGrantVersion, SecretMaterial, SourceCredential,
|
||
|
|
SourceCredentialKind, SourceCredentialPage, SourceCredentialStatus, SourceCredentialVersion,
|
||
|
|
};
|
||
|
|
pub use vault::{LiveVaultVersion, VaultClient, VaultConfig, split_vault_path};
|
||
|
|
|
||
|
|
pub use remora_domain::ports::ActiveCredentialGrant;
|